【ChinaBeta.Cn 网盟学院】
Layers Blocks
include obfuscation/junk198.inc ; I have added a few junks macro
; manually in order to add a
; little fun :)
dec_loader175_1: ; Decrypt label
xor byte ptr [edx],cl ; Defaut options were used.
; Very simple encryption.
inc edx ; Code to decrypt++
dec ecx ; Loop index--
test ecx, ecx ; is ECX = 0 ?
jnz dec_loader175_1 ; no :( therefore we continue
; to decrypt.
; This encryption can be different for each layer if you enable the option in the layer Generator.
lea edx , [ebp+bpxcheck175_1] ; Grab address of BPX check.
cmp byte ptr [edx],0CCh ; Any break point ?
jnz return175_1 ; no. Good boy.
rdtsc ; Ah.. he did put a bpx..
; EAX = random value
push eax ; push eax on stack
ret ; Return to it :) Crash the
; poor guy.
return175_1: ; on return block
include obfuscation/junk199.inc ; a few junk
include obfuscation/junk19A.inc ; ditto.
SEHBLOCK 66137317 28513829 ; SEH block macro with
; keys in parameters.
ret ; return
inst175_2_1: ; another block of code
add dword ptr [esp], 41952561 ; fix return address and return.
ret
inst175_3_1: ; Another block.
mov ecx, (offset _end174_1- @layer175_1) ; Get Size of layer
add dword ptr [esp], 13007360 ; Fix return address and return
ret
inst175_1_1: ; Another block
lea edx, [ebp+@layer175_1] ; Get Layer address
add dword ptr [esp], 30560857 ; Fix the return address
; and return.
ret
EIPtable175_1 dd 000DEADh, (offset inst175_1_1 - offset startloader), (offset inst175_2_1 - offset startloader), (offset inst175_3_1 - offset startloader), (offset _end174_1 - offset startloader)
; This is a table of offset used to redirect the code.
RETable175_1 dd 0031000h, (offset return_addy175_1 - offset startloader - 30560857) , (offset return_addy175_1 - offset startloader - 41952561),(offset return_addy175_1 - offset startloader - 13007360),(offset return_addy175_1 - offset startloader - 37623488)
; This is a table of return address with a little "encryption".
; You can notice the first member of the tables : DEADh and 31000h. Those values are constants and can be random using the RANDOM_FIRST_BLOCK
; option in the layer generator.
The layer presented above has been generated by the little Layer generator Engine i have programmed. I have added comments for the readers.
Layers Blocks
除了obfuscation/junk198.inc，我还添加了一些junks宏。
dec_loader175_1: ; 解密标签
xor byte ptr [edx],cl ; 使用默认选项
; 简单的加密
inc edx ;代码解密++
dec ecx ;循环索引
test ecx, ecx ; 校验ECX是否等于0。
jnz dec_loader175_1 ;非也:( 继续解密).
如果打开加密器中的选项，每个Layer的加密将会不同。
lea edx , [ebp+bpxcheck175_1] ; 获取BPX校验地址.
cmp byte ptr [edx],0CCh ;有断点吗?
jnz return175_1 ; 不错。好孩子。
rdtsc ;它放了一个bpx..
; EAX =任意值
push eax ;eax入栈
ret ;返回 :)崩了你：-）
return175_1: ; on return block
include obfuscation/junk199.inc ;垃圾代码
include obfuscation/junk19A.inc ;同上.
SEHBLOCK 66137317 28513829 ; 以key作为参数的SEH block宏
ret ;返回
inst175_2_1: ;又一个代码block
add dword ptr [esp], 41952561 ;修正返回地址并返回
inst175_3_1: ;.
mov ecx, (offset _end174_1- @layer175_1) ;大小
add dword ptr [esp], 13007360 ;
inst175_1_1: ; 另一个block
lea edx, [ebp+@layer175_1] ; 得到layer地址
add dword ptr [esp], 30560857 ; 修正返回地址并返回
ret
EIPtable175_1 dd 000DEADh, (offset inst175_1_1 - offset startloader), (offset inst175_2_1 - offset startloader),
(offset inst175_3_1 - offset startloader), (offset _end174_1 - offset startloader)
这是一张用来重定向代码的偏移表。
RETable175_1 dd 0031000h, (offset return_addy175_1 - offset startloader - 30560857) , (offset return_addy175_1 - offset startloader - 41952561),
(offset return_addy175_1 - offset startloader - 13007360),(offset return_addy175_1 - offset startloader - 37623488)
这是一张经过一定“加密”的返回地址表。
注意表中的第一个成员：DDH和31000H。它们是常数并可以在加密器的RANDOM_FIRST_BLOCK选项中任意取值。
Protection Weakness:
Those layers have a few weaknesses. You can use BPM (Hardware Break Point) on the next layer once you have passed the SEH that is going to clear the debug registers. Another weakness is the static size of the layer. Using this information, one can pass the layers rather quickly with a few Soft ICE macros for instance. I didn't turn the random size option on, on purpose to allow such attacks.上一页 [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [12] [13] [14] [15] [16] 下一页
（责任编辑：hahack）
|
[软件应用]凤凰涅槃 驱动精灵2008归来 (01-03)
